Salesforce for Aerospace and Defense: ITAR and Controlled Data Considerations

Salesforce for aerospace and defense teams can hold controlled data safely, as long as the environment and the access model are designed around that data before anyone loads a record. Most A&D companies use Salesforce for capture management, contracts, supplier onboarding, and MRO service work. Those records sit right next to ITAR technical data and controlled unclassified information, and the line between them blurs quickly. A single drawing attached to a service case can pull an entire org into export scope.

Primes and tier suppliers tend to ask the same questions when they plan a Salesforce for aerospace and defense rollout. They want to know which environment to buy, whether foreign-national staff or offshore partners can work in the org, and whether encryption takes care of ITAR. They also want to know what the 2026 CMMC pause means for their plans. Each answer depends on the data you actually hold, so classification comes first and tooling comes second. This article is general guidance, and your export compliance lead or legal counsel should make the final call on how specific data is classified.

TL;DR

•   ITAR limits access to technical data to U.S. persons unless the State Department authorizes otherwise. Showing that data to a foreign person inside the United States still counts as an export.

•   The safest design keeps technical data in PLM or a controlled repository and stores only the business records around it in Salesforce.

•   Salesforce Government Cloud Plus is FedRAMP High authorized and runs on AWS GovCloud (US), which makes it the usual home for controlled unclassified information and export-controlled data. The Defense tier is reserved for work that supports a DoD mission owner.

•   Shield encryption protects data at rest, but it rarely qualifies for the ITAR encryption carve-out because Salesforce has to decrypt data to process it.

•   CMMC Phase 2 was suspended on July 13, 2026. DFARS 252.204-7012, NIST SP 800-171, and SPRS obligations still apply in full.

What Controlled Data Means in an Aerospace and Defense Salesforce Org

Any Salesforce for aerospace and defense project has to deal with several rulebooks at once, and each has its own owner and scope. The State Department’s Directorate of Defense Trade Controls (DDTC) runs ITAR, which covers defense articles, technical data, and defense services on the U.S. Munitions List. The Commerce Department’s Bureau of Industry and Security runs the EAR, which covers dual-use items and many military parts that used to sit on the Munitions List. DoD contract clauses then add safeguarding rules for information that flows through a defense contract.

The EAR piece surprises many aerospace teams. Under export control reform, a large share of aircraft parts moved from the Munitions List into the EAR’s 600 series, and in 2014 most commercial communications satellites and related technology moved into the new 9×515 classifications. The Export Administration Regulations published by BIS treat technology in these groups more broadly than most other EAR entries, and deemed export rules still apply. A supplier who assumes “it’s EAR, so it’s fine” can still create a violation by sharing 9E515 technology with the wrong person.

The categories also overlap. The National Archives lists export-controlled information as its own CUI category, marked CUI//EXPT or CUI//SP-EXPT, and the NARA CUI Registry entry for export control explains the markings in detail. Export Control is a CUI category, but ITAR- or EAR-controlled information is CUI only when it meets the CUI definition and applicable government or contract requirements. For DoD work, DFARS 252.204-7012 uses a separate definition of covered defense information, so a record can carry both export-control and contractual safeguarding duties when both definitions apply.

Why ITAR Changes the Way You Run a CRM

ITAR is mainly an access rule. The regulation cares about which people can see unencrypted technical data, and it treats a release to a foreign person as an export even when nobody leaves the country. Under 22 CFR 120.50(a)(2), releasing technical data to a foreign person inside the United States counts as an export. For a CRM that thousands of people log into, that single rule shapes almost every design decision.

The definitions matter, so it’s worth reading them at the source. The ITAR definitions in 22 CFR Part 120 describe a U.S. person as a U.S. citizen, a lawful permanent resident, or a protected individual such as a refugee or asylee. Everyone else is a foreign person for ITAR purposes, including foreign nationals on work visas who sit in your U.S. office. Citizenship of the employer doesn’t change that, and neither does a nondisclosure agreement.

This is where a CRM differs from an engineering vault. Engineering tools usually have a small, vetted user base, while Salesforce reaches sales, service, finance, supplier managers, partner users, and outside consultants. Each of those groups can include foreign persons, and each can reach records through list views, reports, global search, and mobile apps. A single foreign-national service agent who opens a case with an attached drawing has received an export, so the access model has to account for every path into the data.

Salesforce ITAR compliance therefore starts with people and processes, and the platform comes second. You need to know who each user is and what they’re allowed to see. That work involves HR data and export licenses that already exist in most registered companies. The Salesforce org has to enforce those decisions consistently, including for admins, integration users, and support staff who never appear in a sales org chart.

Where Controlled Data Hides Inside Salesforce

In most Salesforce for aerospace and defense deployments, the majority of records aren’t controlled at all. Opportunity stages, contract values, supplier contacts, and MRO schedules usually fall outside ITAR, and many programs never need to store technical data in the CRM. The risk sits in the unstructured places where people paste or attach content without thinking about export rules. Those places are easy to miss during design and hard to clean up later.

Watch these areas closely during discovery:

•   Files and attachments. Engineers attach drawings, test reports, and spec sheets to cases, opportunities, and supplier records to save time.

•   Email-to-Case and email sync. Inbound customer and supplier emails can carry technical attachments straight into a case without anyone reviewing them.

•   Long text and rich text fields. Service notes, failure descriptions, and quote comments often contain part-level technical detail.

•   Knowledge articles. Repair procedures written for field technicians can cross into ITAR technical data very quickly.

•   Collaboration feeds. Chatter posts and connected Slack channels spread content to people who don’t have access to the source record.

•   Report exports. Once a report leaves Salesforce as a spreadsheet, your access controls no longer protect it.

Classification is the fix, and Salesforce gives you tools to record it at the field level. Each field can carry data classification metadata such as a sensitivity level and a compliance category, which makes it easier to find and review sensitive fields later. Teams that set up Salesforce data governance services early usually pair that metadata with a written data dictionary and a review process for new fields. The goal is simple: nobody should add a field or file type that could hold controlled content without a named owner signing off on it.

What ITAR Expects from a Cloud Platform

ITAR doesn’t require companies to store data inside the continental United States. What it requires is that technical data stay out of reach of unauthorized foreign persons, wherever it lives. Keeping data on U.S. soil and limiting access to U.S. persons is still the most common way companies manage that risk, because it removes most of the paths to an unauthorized release. Those questions shape Salesforce ITAR compliance directly, because they cover who runs the provider’s data centers and support desk.

There’s also an encryption carve-out, and it’s narrower than many teams assume. Since March 2020, sending or storing unclassified technical data isn’t an export when all of these conditions hold:

1. The data is unclassified.

2. It’s protected with end-to-end encryption, applied before it leaves the originator’s control and kept until it reaches the intended recipient.

3. The cryptographic modules meet FIPS 140-2 or its successors, or provide security at least as strong as AES-128.

4. The data isn’t intentionally sent to or stored in a country listed in ITAR 126.1 or in Russia.

Key control decides most cases. The carve-out requires that only authorized parties can decrypt the data, so server-side encryption where the cloud provider holds the keys doesn’t qualify. Access to the unencrypted data by an unauthorized foreign person is still an export, even if the data traveled and rested under strong encryption. In other words, the carve-out protects data in transit and at rest, and your access rules take over the moment someone decrypts it.

That limit matters a great deal for a CRM. Salesforce has to decrypt data to search it, filter it, run automation, and render it on a screen, so the carve-out rarely covers records that live and work inside the platform. It’s far more useful for file transfer and archive tools that never need to read the content. For Salesforce ITAR compliance, plan on U.S.-person access controls as your primary safeguard and treat encryption as an extra layer.

Commercial Salesforce vs. Salesforce Government Cloud Plus

Salesforce for aerospace and defense buyers can choose from several government environments, and they aren’t interchangeable. Each tier has its own authorization, price uplift, and purchase rules. The table below summarizes what Salesforce publishes on its government pages as of September 2026.

Salesforce Government Cloud Plus runs on AWS GovCloud (US) as an isolated, dedicated environment, and it holds a FedRAMP High Provisional Authority to Operate from the Joint Authorization Board. The Salesforce Government Cloud overview also points to a third-party assessor’s attestation against NIST SP 800-171 Rev 2, which helps contractors that need to show CMMC readiness. That attestation covers Salesforce’s side of the shared responsibility model. Your own configuration, users, and integrations still need their own evidence.

The infrastructure layer matters for ITAR too. According to the AWS GovCloud ITAR compliance page, GovCloud (US) sits in U.S. locations and AWS limits personnel access to U.S. citizens. Before you sign, ask Salesforce for its Government Cloud Plus security white paper and confirm in writing how its own support and operations staff are screened. Those answers belong in your technology control plan.

The Defense tier has fine print that catches many companies. It requires Common Access Card login and uses salesforce.mil domains, and Salesforce states that contractors can use it only on behalf of, or in direct support of, a DoD mission owner. Contractors can’t buy it for internal use. For most commercial A&D firms, Government Cloud Plus is the realistic ceiling.

Budget for the uplift early. On a $200,000 annual net spend, the 15% uplift adds $30,000 a year, and the Defense tier’s 25% would add $50,000. Because Government Cloud Plus is a separate, isolated environment, an existing commercial org doesn’t simply flip a switch. Plan the move as a data and metadata migration with its own testing and cutover window.

How to Match Your Data to the Right Salesforce Environment

The right environment follows from the data, and the fastest way to decide is to sort your planned use cases into a few clear groups. Mapping data to environments is usually the first workstream in any Salesforce for aerospace and defense project, because every later choice depends on it. VALiNTRY360’s A&D Salesforce consulting practice treats this classification step as a prerequisite before any build starts. The groups below cover most of what primes and suppliers run into.

Business Data with No Technical Content

Pipeline, account contacts, marketing lists, and contract milestones often contain no export-controlled data at all. Commercial Salesforce can work here, provided you enforce the guardrails from the previous sections. That means blocking technical attachments, reviewing email-to-case sources, and training users on what can’t go in the CRM. Many companies run their marketing and early capture work in a commercial org for exactly this reason.

CUI and Export-Controlled Business Records

For CUI or covered defense information subject to DFARS 252.204-7012, the cloud environment has to meet the applicable contractual security requirements. An external cloud provider handling covered defense information must meet FedRAMP Moderate-equivalent security and the clause’s incident and reporting duties. Salesforce Government Cloud Plus can provide a higher Salesforce authorization baseline, but DFARS doesn’t specifically require that product. For standalone ITAR- or EAR-controlled data that isn’t CUI or covered defense information, environment selection depends on export authorization, personnel access, hosting and support arrangements, integrations, and the actual data flow. Some companies still choose Government Cloud Plus for those controls, while others keep controlled technical data out of Salesforce.

DoD Mission Owner Data at IL4 or IL5

If you’re building or running a Salesforce solution for a DoD customer that handles Impact Level 4 or 5 data, the Defense tier is the likely fit. The mission owner’s contract drives eligibility, and CAC-based login changes how users sign in. Classified work is a separate conversation that involves the Premium tier and a national security account team.

How Shield Encryption and Key Control Fit In

Salesforce Shield is worth having in any org that holds controlled data, even though it doesn’t satisfy the ITAR carve-out on its own. Shield Platform Encryption protects data at rest and lets you decide who controls the keys. By default, Salesforce combines a tenant secret you control with a master secret it maintains to derive each data encryption key. You can also upload your own key material or keep it outside Salesforce entirely.

The key options differ in how much control they give you:

Cache-only keys give you a real kill switch, which many security teams running Salesforce for aerospace and defense want for controlled unclassified information. If your organization needs to cut off Salesforce’s access to encrypted data, you revoke the key at your end. Shield also supports deterministic encryption for fields that users need to filter in reports and list views, although it’s a weaker scheme than the default and should be used only where filtering is essential.

The other parts of Shield matter just as much for audits. Event Monitoring records who viewed or exported data, and Field Audit Trail extends field history retention well beyond the standard limits. Transaction Security Policies can block risky actions in real time, such as a large report export by a user who shouldn’t have it. Together, those features give you the evidence trail that proves Salesforce ITAR compliance to auditors and your export compliance team.

How to Build Access Controls Around U.S. Person Status

Access control is where Salesforce ITAR compliance succeeds or fails. The platform has strong sharing tools, but they only work when they’re driven by accurate data about each user. Profile names and team membership aren’t reliable proxies for citizenship or license status. The steps below build access on facts your HR and export teams already maintain.

Record Verified Status on the User

Add a field to the User record that holds verified U.S. person status, and let only a small, controlled group edit it. Feed it from your HR or security system of record instead of relying on self-reporting. Include a date of verification and a link to any license or technology control plan that covers a foreign-person user. That single field becomes the input for every sharing and visibility rule in the org.

Use Restriction Rules and Permission Sets

Standard sharing rules open access, while restriction rules narrow it, which makes them a good fit for ITAR records. You can restrict records flagged as ITAR or EAR so that only users with verified U.S. person status see them, even if other sharing settings would grant access. Pair that with permission sets that gate access to controlled objects, file libraries, and knowledge categories. Test the result with real foreign-person test users, because global search and related lists can expose records you didn’t expect.

Keep Supplier and Partner Portals Separate

Experience Cloud portals often serve foreign suppliers, overseas distributors, and international MRO partners. Build separate sites or strict external sharing rules so a foreign supplier can never reach a record tagged as export-controlled. Firms that plan Experience Cloud implementation for supplier portals with export rules in mind usually give each portal its own audience and data model. It’s much easier to design that separation up front than to retrofit it after suppliers are already onboarded.

Securing Sandboxes, Integrations, and Delivery Teams

In Salesforce for aerospace and defense programs, the production org is only one place where controlled data lives. Full and partial sandboxes copy production data, including anything export-controlled, and developers and testers often have broad access there. Use Salesforce Data Mask or a similar tool to scramble controlled fields before a sandbox opens to users. Treat any sandbox that still holds real controlled data with the same access rules as production.

Delivery teams are a common gap in Salesforce ITAR compliance. Many Salesforce projects use offshore developers or mixed-nationality consulting teams, and a foreign-national developer who opens an unmasked sandbox has received an export. Write U.S.-person staffing requirements into statements of work for any team that touches controlled environments. Ask partners how they verify status, and make sure their answer covers subcontractors as well as their own employees.

Integrations extend your boundary, and each hop needs the same controls as the org itself. Middleware, ETL tools, logging platforms, and backup services all receive the data Salesforce sends them. A secure ERP integration with Salesforce should run on infrastructure that meets the same residency and access standards as your Government Cloud org. Check where integration logs are stored, too, because payload logging can quietly copy controlled records into a commercial SaaS tool.

Using AI and AppExchange Apps with Controlled Data

AI features and third-party apps need their own review in a controlled org. Salesforce has announced FedRAMP High authorization for Agentforce, Data 360, and Marketing Cloud, and it keeps a public knowledge article listing which products run in Government Cloud. Availability can differ from the commercial platform, so confirm every feature in your design against that list before you commit to it. A feature that works in your commercial sandbox may not exist in Government Cloud Plus yet.

AppExchange and AgentExchange apps are a separate question. Salesforce states that these apps sit outside its authorization boundary, although many are native to the platform and keep data inside the environment. Any app that calls an external service can move data outside your boundary, so each one needs a data flow review before installation. That includes document generation tools and file sync connectors that Salesforce for aerospace and defense users often rely on.

Grounding rules matter most for AI agents. An agent that answers questions from cases and knowledge articles can surface export-controlled content to a user who shouldn’t see it, unless it respects the same restriction rules as the rest of the org. Limit agent grounding to approved objects and fields, and test responses with foreign-person test users. An AI readiness assessment for Salesforce helps teams decide which data can safely feed AI features before anyone switches them on.

CMMC, DFARS 7012, and NIST 800-171 in 2026

CMMC has changed several times, and its current status shapes the roadmap for any Salesforce for aerospace and defense program that touches CUI. The timeline below shows the main milestones as of September 22, 2026.

The suspension paused the third-party certification step, and the security duties stayed in place. The Department of War announcement on the CMMC Phase II suspension makes clear that Phase 1 self-assessments continue. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS score postings, and annual affirmations all remain in effect. Contractors who submit inaccurate SPRS scores still face False Claims Act exposure.

For your Salesforce org, that means the controls still have to map cleanly to NIST requirements. The NIST SP 800-171 Rev 2 publication lists 110 security requirements across 14 families, including access control, audit and accountability, and identification and authentication. Salesforce’s attestation covers the platform, while your team owns user provisioning, MFA, audit review, and data handling. Document how each org-level control supports a specific requirement so your affirmation holds up.

The practical takeaway is to keep building. A task-force report doesn’t by itself change a contractor’s current obligations. Follow the applicable contract clauses, 32 CFR Part 170, current DoW implementation guidance, and contracting-officer direction. Contractors that pause their controlled unclassified information work now will likely face a compressed timeline once the program’s direction is settled.

A Step-by-Step Plan for Moving Controlled Data into Salesforce

A Salesforce for aerospace and defense rollout that involves controlled data works best when compliance and program owners agree on the sequence before any configuration starts. Teams that run Salesforce implementation services for regulated industries usually follow a similar order, because each step feeds the next. The plan below assumes you already hold DDTC registration and have a technology control plan in place.

1. Classify the data. Work with your export compliance lead to list every ITAR, EAR, CUI, and FCI data type that could enter Salesforce.

2. Decide what stays out. Keep technical data packages in PLM or a controlled repository, and store references in Salesforce instead of files.

3. Choose the environment. Match each use case to commercial Salesforce, Government Cloud Plus, or the Defense tier, and confirm product availability.

4. Verify users. Load verified U.S. person status for every user, including admins, integration users, and partner users.

5. Build access controls. Configure restriction rules, permission sets, portal sharing, and transaction security policies around that status.

6. Close the side doors. Lock down file types, email-to-case sources, report exports, sandboxes, and integration logs.

7. Turn on Shield. Choose your key model, enable encryption on controlled fields, and set up event monitoring.

8. Map controls to NIST. Record how each Salesforce control supports a NIST SP 800-171 requirement for your SPRS affirmation.

Go-live is where the real work begins, because a Salesforce for aerospace and defense org drifts over time. New fields, new apps, new users, and 3 Salesforce releases a year can each open a gap. A Salesforce managed services and support team can review release notes, audit new metadata, and recheck sharing rules on a fixed schedule. Build those reviews into your technology control plan so they happen whether or not an audit is coming.

Conclusion

Salesforce for aerospace and defense works well when you treat export control as a design input from the first workshop. The biggest risks to Salesforce ITAR compliance come from access, so verified U.S. person status and restriction rules do more for ITAR than any single product feature. Keeping technical data in its system of record reduces what the CRM has to protect, and it makes every later decision easier.

The environment choice follows from the data. Commercial Salesforce can handle business records with no technical content, while Salesforce Government Cloud Plus is the usual home for CUI and export-controlled data. Shield adds encryption and audit evidence, but it doesn’t replace access control. With CMMC Phase 2 on hold and NIST SP 800-171 still required, contractors that keep building sound controls now will be ready whichever way the program moves.

Frequently Asked Questions

Is Salesforce ITAR compliant?

No cloud product is ITAR compliant on its own, because compliance belongs to your export program. Salesforce Government Cloud Plus gives you U.S.-based infrastructure and FedRAMP High authorization to build on. Salesforce ITAR compliance depends on your access controls and user verification.

Can an ITAR-registered company use commercial Salesforce?

Yes. Commercial Salesforce can be used for business data that isn’t controlled, and standalone ITAR- or EAR-controlled data doesn’t automatically require Government Cloud Plus. If CUI or covered defense information is subject to DFARS 252.204-7012, the applicable cloud-security and reporting requirements must be met. Government Cloud Plus can provide a higher Salesforce authorization baseline. For standalone export-controlled data, the right environment depends on export authorization, personnel access, hosting and support arrangements, integrations, and the actual data flow.

What is the difference between Government Cloud Plus and Government Cloud Plus – Defense?

Government Cloud Plus supports FedRAMP High and DoD IL2, with a 15% uplift on net spend. The Defense tier supports DoD IL4 and IL5, carries a 25% uplift, and requires CAC login. Contractors can only use the Defense tier on behalf of a DoD mission owner.

Can foreign nationals use a Salesforce org that holds ITAR data?

They can use the org, but they can’t see ITAR technical data unless DDTC has authorized that access. Restriction rules and permission sets driven by verified U.S. person status keep controlled records out of their reach. Test the setup with foreign-person test users to confirm nothing leaks through search or reports.

Does Shield encryption put Salesforce data under the ITAR encryption carve-out?

Usually not. The carve-out requires end-to-end encryption where only authorized parties can decrypt, and Salesforce decrypts data to process and display it. Shield strengthens protection at rest and gives you key control, while access rules remain your main ITAR safeguard.

What counts as a deemed export in Salesforce?

A deemed export happens when a foreign person inside the United States sees controlled technical data. In Salesforce, that could be a foreign-national agent opening a case with a drawing attached. It could also be an offshore developer working in an unmasked sandbox.

Is export-controlled data the same as CUI?

No. Export Control is a CUI category, but ITAR- or EAR-controlled information isn’t automatically CUI. It becomes CUI only when it meets the CUI definition and the applicable government or contract requirements. For DoD contracts, DFARS 252.204-7012 separately defines covered defense information, which can create additional safeguarding and reporting duties.

Do EAR-controlled items need the same care as ITAR data?

EAR controls are generally more flexible, but 600 series and 9×515 technology still carries deemed export rules and broad technology definitions. Many aircraft parts and commercial satellites moved from ITAR to these EAR groups. Classify them carefully before you decide who can see them in Salesforce.

Does ITAR require data to stay in the United States?

ITAR doesn’t require U.S. storage. It requires that unauthorized foreign persons can’t access technical data. U.S. storage with U.S.-person access is the most common way companies meet that requirement, and it’s why many choose GovCloud-based environments.

Can suppliers outside the U.S. use our Salesforce supplier portal?

Yes, if the portal keeps them away from controlled records. Build separate Experience Cloud sites or strict external sharing rules, and tag controlled records so portal users can never reach them. Review portal access whenever a supplier’s scope changes.

How should we handle Salesforce sandboxes that contain controlled data?

Mask controlled fields with Data Mask or a similar tool before developers or testers get access. If a sandbox must hold real controlled data, apply the same U.S.-person access rules as production. Write these rules into partner statements of work as well.

Are AppExchange apps covered by Salesforce’s Government Cloud authorization?

No. Salesforce states that AppExchange and AgentExchange apps sit outside its authorization boundary. Many native apps keep data inside the environment, but any app that calls an external service needs a data flow review before you install it.

Can we use Agentforce with export-controlled data?

Salesforce has announced FedRAMP High authorization for Agentforce, but you still need to check availability in your environment. Limit agent grounding to approved objects and fields, and make sure agents follow the same restriction rules as users. Test responses with foreign-person test users before launch.

Does the CMMC Phase 2 suspension mean we can wait?

No. DFARS 252.204-7012, NIST SP 800-171, SPRS postings, and annual affirmations still apply. A Salesforce org holding controlled unclassified information needs those controls in place now, and inaccurate SPRS scores still carry False Claims Act risk.

How much more does Salesforce Government Cloud Plus cost?

Salesforce lists a 15% uplift on net spend for Government Cloud Plus and 25% for the Defense tier. The Premium tier is priced on request. Also budget for migration, because moving from a commercial org to Government Cloud Plus is a separate project.